Trust Centre

Evidence about the processing environment in the form of the Attestation of Compliance for the PCI DSS Level 1 validation, the security statement describing the controls in force, the subprocessor register naming each provider with what it is engaged to do, together with the current full list, the data processing addendum, the privacy policy, the accessibility statement and the vulnerability disclosure route. Most of that is published, so a reviewer can start reading before anyone is on a call.

On redundant virtual environments across cloud data centres, whose providers operate backup power generation and dual-path power distribution, run continuous on-site surveillance and restrict physical access to key personnel through multi-factor controls including biometrics. Databases are backed up daily, both between data centres and offsite. The subprocessors page sets out the infrastructure and hosting category and what it can reach, and section 9 of that page publishes the register naming the providers it evidences, states in terms that the cloud data centre providers behind the platform are not among them, and sets out the route for obtaining the current full list.

Intrusion detection and intrusion prevention run at the firewall and locally on every server, screening traffic for suspicious behaviour, abnormal volumes and malicious code, with the prevention layer acting rather than only recording. Server firewalls default to deny-all, so a connection is refused unless a reviewed rule permits it. Servers are hardened and patched, major vulnerabilities are addressed without delay under change control, and there is no wireless access to the platform environment.

The privacy policy covers collection, use and protection under PIPEDA, and the data processing addendum is the processing terms in writing, which clause 19 of that addendum records as applying to every merchant and binding RapidCents without a separate signature. A designated Privacy Officer is accountable for compliance with the policy and for answering requests and complaints, reachable at the North York address or on +1 (844) 957-2743. Cardholder data is retained for up to 24 months of inactivity; identity and onboarding records are held for the period anti-money-laundering legislation requires.

Public marketing surfaces target WCAG 2.2 AA conformance, and the accessibility statement is published with the rest of the legal set. A document in an alternate format, or feedback about a barrier, can be requested through the contact page, by telephone on +1 (844) 957-2743, by mail, or in person at the North York address. Feedback can be left anonymously, though a reply needs a way to reach you.